Kpi host

x-pack/plugins/siem/public/components/page/hosts/index.tsx

@@ -8,3 +8,4 @@ export * from './events_table';
 export * from './hosts_table';
 export * from './types_bar';
 export * from './uncommon_process_table';
+export * from './kpi_hosts';

x-pack/plugins/siem/public/components/page/hosts/kpi_hosts/index.tsx

@@ -0,0 +1,149 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiFlexGroup } from '@elastic/eui';
+import { get } from 'lodash/fp';
+import React from 'react';
+import { pure } from 'recompose';
+
+import { KpiHostsData } from '../../../../graphql/types';
+import { CardItem, CardItems, CardItemsComponent } from '../../../card_items';
+
+import * as i18n from './translations';
+
+interface KpiHostsProps {
+  data: KpiHostsData;
+  loading: boolean;
+}
+
+const fieldTitleMapping: Readonly<CardItems[]> = [
+  {
+    fields: [
+      {
+        key: 'hosts',
+        description: i18n.HOSTS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'installedPackages',
+        description: i18n.INSTALLED_PACKAGES,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'processCount',
+        description: i18n.PROCESS_COUNT,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'authenticationSuccess',
+        description: i18n.AUTHENTICATION_SUCCESS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'authenticationFailure',
+        description: i18n.AUTHENTICATION_FAILURE,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'fimEvents',
+        description: i18n.FIM_EVENTS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'auditdEvents',
+        description: i18n.AUDITD_EVENTS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'winlogbeatEvents',
+        description: i18n.WINLOGBEAT_EVENTS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'filebeatEvents',
+        description: i18n.FILEBEAT_EVENTS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'sockets',
+        description: i18n.SOCKETS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'uniqueSourceIps',
+        description: i18n.UNIQUE_SOURCE_IPS,
+        value: null,
+      },
+    ],
+  },
+  {
+    fields: [
+      {
+        key: 'uniqueDestinationIps',
+        description: i18n.UNIQUE_DESTINATION_IPS,
+        value: null,
+      },
+    ],
+  },
+];
+
+export const KpiHostsComponent = pure<KpiHostsProps>(({ data, loading }) => {
+  return (
+    <EuiFlexGroup>
+      {fieldTitleMapping.map(card => (
+        <CardItemsComponent
+          key={`kpi-hosts-summary-${card.fields[0].description}`}
+          isLoading={loading}
+          description={card.description}
+          fields={addValueToFields(card.fields, data)}
+        />
+      ))}
+    </EuiFlexGroup>
+  );
+});
+
+const addValueToFields = (fields: CardItem[], data: KpiHostsData): CardItem[] =>
+  fields.map(field => ({ ...field, value: get(field.key, data) }));

x-pack/plugins/siem/public/components/page/hosts/kpi_hosts/translations.ts

@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+
+export const HOSTS = i18n.translate('xpack.siem.kpiHosts.source.hostsTitle', {
+  defaultMessage: 'Hosts',
+});
+
+export const INSTALLED_PACKAGES = i18n.translate(
+  'xpack.siem.kpiHosts.source.installedPackagesTitle',
+  {
+    defaultMessage: 'Packages',
+  }
+);
+
+export const PROCESS_COUNT = i18n.translate('xpack.siem.kpiHosts.source.processCountsTitle', {
+  defaultMessage: 'Processes',
+});
+
+export const AUTHENTICATION_SUCCESS = i18n.translate(
+  'xpack.siem.kpiHosts.source.authenticationSuccessTitle',
+  {
+    defaultMessage: 'Authentication Success',
+  }
+);
+
+export const AUTHENTICATION_FAILURE = i18n.translate(
+  'xpack.siem.kpiHosts.source.authenticationFailureTitle',
+  {
+    defaultMessage: 'Authentication Failure',
+  }
+);
+
+export const FIM_EVENTS = i18n.translate('xpack.siem.kpiHosts.source.fimEventsTitle', {
+  defaultMessage: 'Auditbeat FIM Events',
+});
+
+export const AUDITD_EVENTS = i18n.translate('xpack.siem.kpiHosts.source.auditEventsTitle', {
+  defaultMessage: 'Auditbeat Auditd Events',
+});
+
+export const WINLOGBEAT_EVENTS = i18n.translate(
+  'xpack.siem.kpiHosts.source.winlogbeatEventsTitle',
+  {
+    defaultMessage: 'Winlogbeat Events',
+  }
+);
+
+export const FILEBEAT_EVENTS = i18n.translate('xpack.siem.kpiHosts.source.filebeatEventsTitle', {
+  defaultMessage: 'Filebeat Events',
+});
+
+export const SOCKETS = i18n.translate('xpack.siem.kpiHosts.source.socketsTitle', {
+  defaultMessage: 'Sockets',
+});
+
+export const UNIQUE_SOURCE_IPS = i18n.translate('xpack.siem.kpiHosts.source.uniqueSourceIpsTitle', {
+  defaultMessage: 'Unique Source Ips',
+});
+
+export const UNIQUE_DESTINATION_IPS = i18n.translate(
+  'xpack.siem.kpiHosts.source.uniqueDestinationIpsTitle',
+  {
+    defaultMessage: 'Unique Destination Ips',
+  }
+);

x-pack/plugins/siem/public/containers/kpi_hosts/index.gql_query.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import gql from 'graphql-tag';
+
+export const kpiHostsQuery = gql`
+  query GetKpiHostsQuery($sourceId: ID!, $timerange: TimerangeInput!, $filterQuery: String) {
+    source(id: $sourceId) {
+      id
+      KpiHosts(timerange: $timerange, filterQuery: $filterQuery) {
+        hosts
+        installedPackages
+        processCount
+        authenticationSuccess
+        authenticationFailure
+        fimEvents
+        auditdEvents
+        winlogbeatEvents
+        filebeatEvents
+        sockets
+        uniqueSourceIps
+        uniqueDestinationIps
+      }
+    }
+  }
+`;

x-pack/plugins/siem/public/containers/kpi_hosts/index.tsx

@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+import React from 'react';
+import { Query } from 'react-apollo';
+import { pure } from 'recompose';
+
+import { GetKpiHostsQuery, KpiHostsData } from '../../graphql/types';
+import { inputsModel } from '../../store';
+import { createFilter } from '../helpers';
+import { QueryTemplateProps } from '../query_template';
+
+import { kpiHostsQuery } from './index.gql_query';
+
+export interface KpiHostsArgs {
+  id: string;
+  kpiHosts: KpiHostsData;
+  loading: boolean;
+  refetch: inputsModel.Refetch;
+}
+
+export interface KpiHostsProps extends QueryTemplateProps {
+  children: (args: KpiHostsArgs) => React.ReactNode;
+}
+
+export const KpiHostsQuery = pure<KpiHostsProps>(
+  ({ id = 'kpiHostsQuery', children, filterQuery, sourceId, startDate, endDate }) => (
+    <Query<GetKpiHostsQuery.Query, GetKpiHostsQuery.Variables>
+      query={kpiHostsQuery}
+      fetchPolicy="cache-and-network"
+      notifyOnNetworkStatusChange
+      variables={{
+        sourceId,
+        timerange: {
+          interval: '12h',
+          from: startDate!,
+          to: endDate!,
+        },
+        filterQuery: createFilter(filterQuery),
+      }}
+    >
+      {({ data, loading, refetch }) => {
+        const kpiHosts = getOr({}, `source.KpiHosts`, data);
+        return children({
+          id,
+          kpiHosts,
+          loading,
+          refetch,
+        });
+      }}
+    </Query>
+  )
+);